{"id":"CVE-2026-30927","aliases":["GHSA-7pfv-hr63-h7cw"],"url":"https://o3.security/vulnerability/CVE-2026-30927","summary":"Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter","details":"Admidio is an open-source user management solution. Prior to 5.0.6, in modules/events/events_function.php, the event participation logic allows any user who can participate in an event to register OTHER users by manipulating the user_uuid GET parameter. The condition uses || (OR), meaning if possibleToParticipate() returns true (event is open for participation), ANY user - not just leaders - can specify a different user_uuid and register/cancel participation for that user. The code then operates on $user->getValue('usr_id') (the target user from user_uuid) rather than the current user. This vulnerability is fixed in 5.0.6.","published":"2026-03-09T23:03:55.824Z","modified":"2026-08-12T03:51:29.057766836Z","cvss":null,"epss":{"score":0.00253,"percentile":0.16529,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"admidio/admidio","fixedVersion":"5.0.6"}],"fix":{"url":"https://github.com/Admidio/admidio/commit/e47f70cc3cbcdb39635fdbaaef02d19f604b8c3e","label":"Admidio/admidio@e47f70c"},"references":[{"type":"ADVISORY","url":"https://github.com/Admidio/admidio/security/advisories/GHSA-7pfv-hr63-h7cw"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30927.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30927"},{"type":"REPORT","url":"https://github.com/Admidio/admidio/issues/1985"},{"type":"FIX","url":"https://github.com/Admidio/admidio/commit/e47f70cc3cbcdb39635fdbaaef02d19f604b8c3e"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:29.057766836Z"}}